@mnemonik/cli 7.154.3 → 7.155.2

package/dist/scanner/estimate.js

@@ -0,0 +1,2461 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __commonJS = (cb, mod) => function __require() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// node_modules/ignore/index.js
+var require_ignore = __commonJS({
+  "node_modules/ignore/index.js"(exports, module) {
+    function makeArray(subject) {
+      return Array.isArray(subject) ? subject : [subject];
+    }
+    var UNDEFINED = void 0;
+    var EMPTY = "";
+    var SPACE = " ";
+    var ESCAPE = "\\";
+    var REGEX_LITERAL_SPECIAL = /[.*+?()[\]{}^$|\\/]/;
+    var BOM = "\uFEFF";
+    var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
+    var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
+    var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
+    var REGEX_SPLITALL_CRLF = /\r?\n/g;
+    var DOUBLE_SLASH = "//";
+    var SLASH_CODE = 47;
+    var DOT_CODE = 46;
+    var SLASH = "/";
+    var TMP_KEY_IGNORE = "node-ignore";
+    if (typeof Symbol !== "undefined") {
+      TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
+    }
+    var KEY_IGNORE = TMP_KEY_IGNORE;
+    var define = (object, key, value) => {
+      Object.defineProperty(object, key, { value });
+      return value;
+    };
+    var RETURN_FALSE = () => false;
+    var cleanRangeBackSlash = (slashes) => {
+      const { length } = slashes;
+      return slashes.slice(0, length - length % 2);
+    };
+    var POSIX_CLASSES = {
+      alnum: "0-9A-Za-z",
+      alpha: "A-Za-z",
+      blank: " \\t",
+      cntrl: "\\x00-\\x1f\\x7f",
+      digit: "0-9",
+      graph: "!-.0-~",
+      lower: "a-z",
+      print: " -.0-~",
+      punct: "!-.:-@\\[-`{-~",
+      // git's `sane-ctype.h` classifies \v and \f as control, not space,
+      //   unlike C's `isspace`
+      space: " \\t\\n\\r",
+      upper: "A-Z",
+      xdigit: "0-9A-Fa-f"
+    };
+    var CLASS_MEMBERS_TO_ESCAPE = "\\]^-[";
+    var escapeMember = (char) => CLASS_MEMBERS_TO_ESCAPE.indexOf(char) < 0 ? char : ESCAPE + char;
+    var NON_SLASH = "(?!\\/)";
+    var classSource = (negated, body) => {
+      if (negated) {
+        return `[^\\/${body}]`;
+      }
+      const source = `[${body}]`;
+      return new RegExp(source).test("/") ? NON_SLASH + source : source;
+    };
+    var scanBracket = (pattern, start) => {
+      const { length } = pattern;
+      let index = start + 1;
+      let negated = EMPTY;
+      const lead = pattern[index];
+      if (lead === "!" || lead === "^") {
+        negated = "^";
+        index++;
+      }
+      let body = EMPTY;
+      let prev = EMPTY;
+      for (; ; ) {
+        const char = pattern[index];
+        if (char === UNDEFINED) {
+          return null;
+        }
+        if (char === ESCAPE) {
+          const escaped = pattern[index + 1];
+          if (escaped === UNDEFINED) {
+            return null;
+          }
+          body += escapeMember(escaped);
+          prev = escaped;
+          index++;
+        } else if (char === "-" && prev && index + 1 < length && pattern[index + 1] !== "]") {
+          index++;
+          let to = pattern[index];
+          if (to === ESCAPE) {
+            to = pattern[index += 1];
+          }
+          if (prev <= to) {
+            body += `-${escapeMember(to)}`;
+          }
+          prev = EMPTY;
+        } else if (char === "[" && pattern[index + 1] === ":") {
+          const nameStart = index + 2;
+          let end = nameStart;
+          while (end < length && pattern[end] !== "]") {
+            end++;
+          }
+          if (end === length) {
+            return null;
+          }
+          if (end > nameStart && pattern[end - 1] === ":") {
+            const expanded = POSIX_CLASSES[pattern.slice(nameStart, end - 1)];
+            if (expanded === UNDEFINED) {
+              return null;
+            }
+            body += expanded;
+            prev = EMPTY;
+            index = end;
+          } else {
+            body += escapeMember("[");
+            prev = "[";
+            index = nameStart - 2;
+          }
+        } else {
+          body += escapeMember(char);
+          prev = char;
+        }
+        index++;
+        if (pattern[index] === "]") {
+          return {
+            end: index,
+            source: classSource(negated, body)
+          };
+        }
+      }
+    };
+    var NEVER_MATCH = "[]";
+    var PLACEHOLDER = "\0";
+    var REGEX_RESTORE_PLACEHOLDER = new RegExp(
+      `${PLACEHOLDER}(\\d+)${PLACEHOLDER}`,
+      "g"
+    );
+    var TRAILING_WILDCARD = "\uE000";
+    var TRAILING_DOUBLESTAR = "\uE001";
+    var extractBrackets = (pattern) => {
+      const sources = [];
+      const hold = (source) => `${PLACEHOLDER}${sources.push(source) - 1}${PLACEHOLDER}`;
+      const { length } = pattern;
+      let out = EMPTY;
+      let index = 0;
+      while (index < length) {
+        const char = pattern[index];
+        if (char === ESCAPE) {
+          const escaped = pattern[index + 1];
+          if (escaped === UNDEFINED || escaped === SLASH && index + 2 === length) {
+            out += hold(NEVER_MATCH);
+          } else if (escaped === "*" || escaped === "[" || escaped === SPACE || escaped === ESCAPE) {
+            out += pattern.slice(index, index + 2);
+          } else {
+            out += hold(
+              REGEX_LITERAL_SPECIAL.test(escaped) ? ESCAPE + escaped : escaped
+            );
+          }
+          index += 2;
+        } else if (char === PLACEHOLDER) {
+          out += hold(`[${PLACEHOLDER}]`);
+          index++;
+        } else if (char === "[") {
+          const scanned = scanBracket(pattern, index);
+          if (scanned === null) {
+            out += hold(NEVER_MATCH);
+            index = length;
+          } else {
+            out += hold(scanned.source);
+            index = scanned.end + 1;
+          }
+        } else {
+          out += char;
+          index++;
+        }
+      }
+      return {
+        source: out,
+        sources
+      };
+    };
+    var DIRECT = null;
+    var REGEX_INNER_SLASH = /\/(?!$)/;
+    var REPLACERS = [
+      // Replace (\ ) with ' '
+      // Only a space: an escaped tab or other whitespace is already a literal by
+      //   the time it reaches here, and a bare tab must be left as one, not turned
+      //   into a space.
+      // (\ ) -> ' '
+      // (\\ ) -> '\\ '
+      // (\\\ ) -> '\\ '
+      [
+        // A run of backslashes is taken whole, from its first one, so no match
+        //   ever starts again inside it -- `(\\+?) ` did, which made a long run
+        //   quadratic.
+        /(\\+)( ?)/g,
+        (_, run, space) => space ? run.slice(0, run.length - run.length % 2) + SPACE : run,
+        ESCAPE + SPACE
+      ],
+      // Escape metacharacters
+      // which is written down by users but means special for regular expressions.
+      // > There are 12 characters with special meanings:
+      // > - the backslash \,
+      // > - the caret ^,
+      // > - the dollar sign $,
+      // > - the period or dot .,
+      // > - the vertical bar or pipe symbol |,
+      // > - the question mark ?,
+      // > - the asterisk or star *,
+      // > - the plus sign +,
+      // > - the opening parenthesis (,
+      // > - the closing parenthesis ),
+      // > - and the opening square bracket [,
+      // > - the opening curly brace {,
+      // > These special characters are often called "metacharacters".
+      [
+        /[\\$.|*+(){^]/g,
+        (match) => `\\${match}`
+      ],
+      [
+        // > a question mark (?) matches a single character
+        /(?!\\)\?/g,
+        () => "[^/]",
+        "?"
+      ],
+      // leading slash
+      [
+        // > A leading slash matches the beginning of the pathname.
+        // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
+        // A leading slash matches the beginning of the pathname
+        /^\//,
+        () => "^",
+        SLASH
+      ],
+      // replace special metacharacter slash after the leading slash
+      [
+        /\//g,
+        () => "\\/",
+        SLASH
+      ],
+      [
+        // > A leading "**" followed by a slash means match in all directories.
+        // > For example, "**/foo" matches file or directory "foo" anywhere,
+        // > the same as pattern "foo".
+        // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
+        // >   under directory "foo".
+        // Notice that the '*'s have been replaced as '\\*'
+        /^\^*(?:\\\*\\\*\\\/)+/,
+        // '**/foo' <-> 'foo'
+        () => "^(?:.*\\/)?",
+        "*"
+      ],
+      // starting
+      [
+        // there will be no leading '/'
+        //   (which has been replaced by section "leading slash")
+        // If starts with '**', adding a '^' to the regular expression also works
+        DIRECT,
+        (source, pattern) => {
+          if (!source || source[0] === "^") {
+            return source;
+          }
+          const anchor = !REGEX_INNER_SLASH.test(pattern) ? "(?:^|\\/)" : "^";
+          return anchor + source;
+        }
+      ],
+      // two globstars
+      [
+        // Use lookahead assertions so that we could match more than one `'/**'`
+        /\\\/\\\*\\\*(?=\\\/|$)/g,
+        // Zero, one or several directories
+        // should not use '*', or it will be replaced by the next replacer
+        // Check if it is not the last `'/**'`
+        (_, index, str) => index + 6 < str.length ? str.slice(index + 6) === "\\/" ? "(?:\\/[^\\/]+)+" : "(?:\\/[^\\/]+)*" : `\\/${TRAILING_DOUBLESTAR}`,
+        "*"
+      ],
+      // normal intermediate wildcards
+      [
+        // Never replace escaped '*'
+        // ignore rule '\*' will match the path '*'
+        // 'abc.*/' -> go
+        // 'abc.*'  -> skip this rule,
+        //    coz trailing single wildcard will be handed by [trailing wildcard]
+        /(^|[^\\]+)(\\\*)+(?=.+)/g,
+        // '*.js' matches '.js'
+        // '*.js' doesn't match 'abc'
+        (_, p1, p2) => {
+          const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
+          return p1 + unescaped;
+        },
+        "*"
+      ],
+      // trailing wildcard, held apart from a literal star
+      [
+        // The step above leaves a trailing `*` alone, so a single `\*` is all that
+        //   can be left at the end here. Whether it is a wildcard or a literal
+        //   turns on the backslashes the user put in front of it: the escaper has
+        //   since doubled every one, so what stands here is those `2N` doubled
+        //   backslashes and then the star's own escape. An even number of the
+        //   original `N` leaves the star unescaped -- a wildcard -- and an odd
+        //   number escapes it -- a literal. This runs while the two are still
+        //   distinct, before the unescape steps below collapse the literal onto
+        //   the very `\*` a wildcard leaves behind.
+        /(^|[^\\])((?:\\\\)*)\\\*$/,
+        (match, p1, p2) => (
+          // `p2` holds the doubled user backslashes; half of them is `N`.
+          p2.length / 2 % 2 === 0 ? p1 + p2 + TRAILING_WILDCARD : match
+        ),
+        "*"
+      ],
+      [
+        // unescape, revert step 3 except for back slash
+        // For example, if a user escape a '\\*',
+        // after step 3, the result will be '\\\\\\*'
+        /\\\\\\(?=[$.|*+(){^])/g,
+        () => ESCAPE,
+        ESCAPE + ESCAPE
+      ],
+      [
+        // '\\\\' -> '\\'
+        /\\\\/g,
+        () => ESCAPE,
+        ESCAPE + ESCAPE
+      ],
+      [
+        // Every real bracket expression -- POSIX classes included -- has already
+        //   been held aside by `extractBrackets`, so the only `[` left in the
+        //   pattern is an escaped, literal one.
+        // `\` is escaped by step 3
+        /\\\[([^\]/]*?)(\\*)($|\])/g,
+        // '\\[bar]' -> '\\\\[bar\\]'
+        (match, range, endEscape, close) => `\\[${range}${cleanRangeBackSlash(endEscape)}${close}`,
+        "["
+      ],
+      // ending
+      [
+        // 'js' will not match 'js.'
+        // 'ab' will not match 'abc'
+        DIRECT,
+        // WTF!
+        // https://git-scm.com/docs/gitignore
+        // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
+        // which re-fixes #24, #38
+        // > If there is a separator at the end of the pattern then the pattern
+        // > will only match directories, otherwise the pattern can match both
+        // > files and directories.
+        // 'js*' will not match 'a.js'
+        // 'js/' will not match 'a.js'
+        // 'js' will match 'a.js' and 'a.js/'
+        (source) => {
+          const last = source[source.length - 1];
+          if (!last || last === TRAILING_WILDCARD || last === TRAILING_DOUBLESTAR) {
+            return source;
+          }
+          return last === SLASH ? `${source}$` : `${source}(?=$|\\/$)`;
+        }
+      ]
+    ];
+    var REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\uE000$/;
+    var MODE_IGNORE = "regex";
+    var MODE_CHECK_IGNORE = "checkRegex";
+    var UNDERSCORE = "_";
+    var replaceTrailingWildcard = (_, p1) => {
+      const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
+      return `${prefix}(?=$|\\/$)`;
+    };
+    var REGEX_REPLACE_TRAILING_DOUBLESTAR = /\uE001$/;
+    var replaceTrailingDoublestar = () => ".+(?=$|\\/$)";
+    var WILDCARD = "[^\\/]*";
+    var separatorAfter = (run, at) => {
+      let separator = EMPTY;
+      for (let index = at + 1; index < run.length && !run[index].wildcard; index++) {
+        separator += run[index].single;
+      }
+      return separator;
+    };
+    var pinWildcards = (source) => {
+      if (source.indexOf(WILDCARD) < 0) {
+        return source;
+      }
+      const tokens = [];
+      const { length } = source;
+      let index = 0;
+      while (index < length) {
+        const char = source[index];
+        if (source.startsWith(WILDCARD, index)) {
+          tokens.push({ wildcard: true });
+          index += WILDCARD.length;
+        } else if (char === "[") {
+          let end = index + 1;
+          if (source[end] === "^") {
+            end++;
+          }
+          if (source[end] === "]") {
+            end++;
+          }
+          while (end < length && source[end] !== "]") {
+            end += source[end] === ESCAPE ? 2 : 1;
+          }
+          end++;
+          tokens.push({ single: source.slice(index, end) });
+          index = end;
+        } else if (char === ESCAPE) {
+          tokens.push({ single: source.slice(index, index + 2) });
+          index += 2;
+        } else if (char === "(") {
+          let depth = 0;
+          let end = index;
+          do {
+            if (source[end] === ESCAPE) {
+              end++;
+            } else if (source[end] === "(") {
+              depth++;
+            } else if (source[end] === ")") {
+              depth--;
+            }
+            end++;
+          } while (end < length && depth > 0);
+          if ("*+?".indexOf(source[end]) >= 0) {
+            end++;
+          }
+          tokens.push({ boundary: source.slice(index, end) });
+          index = end;
+        } else if (char === "^" || char === "$") {
+          tokens.push({ boundary: char });
+          index++;
+        } else {
+          tokens.push({ single: char });
+          index++;
+        }
+      }
+      let out = EMPTY;
+      let run = [];
+      const flush = () => {
+        let lastWildcard;
+        run.forEach((token, at) => {
+          if (token.wildcard) {
+            lastWildcard = at;
+          }
+        });
+        run.forEach((token, at) => {
+          if (!token.wildcard) {
+            out += token.single;
+            return;
+          }
+          out += at === lastWildcard ? WILDCARD : `(?:(?!${separatorAfter(run, at)})[^\\/])*`;
+        });
+        run = [];
+      };
+      tokens.forEach((token) => {
+        if (token.boundary === void 0) {
+          run.push(token);
+          return;
+        }
+        flush();
+        out += token.boundary;
+      });
+      flush();
+      return out;
+    };
+    var makeRegexPrefix = (pattern) => {
+      const { source, sources } = extractBrackets(pattern);
+      const replaced = REPLACERS.reduce(
+        // A pass whose matcher finds nothing hands back the very string it was
+        //   given, so asking first costs a search and saves a rewrite. Ten of the
+        //   fifteen passes never fire for a typical .gitignore line, and between
+        //   them they were 45% of this chain.
+        (prev, [matcher, replacer, required]) => {
+          if (matcher === DIRECT) {
+            return replacer(prev, pattern);
+          }
+          if (required !== UNDEFINED && prev.indexOf(required) < 0) {
+            return prev;
+          }
+          return matcher.test(prev) ? prev.replace(matcher, replacer.bind(pattern)) : prev;
+        },
+        source
+      );
+      return sources.length ? replaced.replace(
+        REGEX_RESTORE_PLACEHOLDER,
+        (match, index) => sources[index]
+      ) : replaced;
+    };
+    var checkSourceOf = (body, prefix) => {
+      if (body[body.length - 1] === SLASH) {
+        prefix = makeRegexPrefix(body.slice(0, -1));
+      }
+      const head = prefix.slice(0, -1);
+      const last = prefix[prefix.length - 1];
+      return last === TRAILING_WILDCARD ? `${head}$` : last === TRAILING_DOUBLESTAR ? `${head}.*$` : NEVER_MATCH;
+    };
+    var matchesBasename = (body) => {
+      const index = body.indexOf(SLASH);
+      return index < 0 || index === body.length - 1;
+    };
+    var basenameOf = (path) => {
+      const end = path.length - 1;
+      const index = path.lastIndexOf(
+        SLASH,
+        path[end] === SLASH ? end - 1 : end
+      );
+      return index < 0 ? path : path.slice(index + 1);
+    };
+    var parentOf = (path) => {
+      if (path.charCodeAt(0) === SLASH_CODE || path.indexOf(DOUBLE_SLASH) >= 0) {
+        const slices = path.split(SLASH).filter(Boolean);
+        slices.pop();
+        return slices.length ? slices.join(SLASH) + SLASH : EMPTY;
+      }
+      const end = path.length - 1;
+      const cut = path.lastIndexOf(
+        SLASH,
+        path.charCodeAt(end) === SLASH_CODE ? end - 1 : end
+      );
+      return cut < 0 ? EMPTY : path.slice(0, cut + 1);
+    };
+    var isString = (subject) => typeof subject === "string";
+    var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern);
+    var splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
+    var IgnoreRule = class {
+      constructor(pattern, mark, body, ignoreCase, negative, prefix) {
+        this.pattern = pattern;
+        this.mark = mark;
+        this.negative = negative;
+        define(this, "body", body);
+        define(this, "ignoreCase", ignoreCase);
+        define(this, "regexPrefix", prefix);
+      }
+      // Worked out on first use and kept behind an own property, the way `regex`
+      //   caches itself in `_regex`. Deciding it in the constructor instead would
+      //   add a fourth `defineProperty` to every rule ever built, which cost 4% of
+      //   every compile -- including the compiles of rules that are never matched
+      //   against anything.
+      get _basenameOnly() {
+        return define(this, "_basenameOnly", matchesBasename(this.body));
+      }
+      get regex() {
+        const key = UNDERSCORE + MODE_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_IGNORE, key);
+      }
+      get checkRegex() {
+        const key = UNDERSCORE + MODE_CHECK_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_CHECK_IGNORE, key);
+      }
+      _make(mode, key) {
+        const str = pinWildcards(
+          mode === MODE_IGNORE ? this.regexPrefix.replace(REGEX_REPLACE_TRAILING_WILDCARD, replaceTrailingWildcard).replace(REGEX_REPLACE_TRAILING_DOUBLESTAR, replaceTrailingDoublestar) : checkSourceOf(this.body, this.regexPrefix)
+        );
+        const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
+        return define(this, key, regex);
+      }
+    };
+    var isLineEnd = (char) => char === "\r" || char === "\n";
+    var trimEnd = (body) => {
+      let end = body.length;
+      while (end && isLineEnd(body[end - 1])) {
+        end--;
+      }
+      const lineEnd = end;
+      while (end && body[end - 1] === SPACE) {
+        end--;
+      }
+      if (end === lineEnd) {
+        return body.slice(0, end);
+      }
+      let backslashes = 0;
+      while (backslashes < end && body[end - backslashes - 1] === ESCAPE) {
+        backslashes++;
+      }
+      return backslashes % 2 ? body.slice(0, end - 1) + SPACE : body.slice(0, end);
+    };
+    var createRule = ({
+      pattern,
+      mark
+    }, ignoreCase) => {
+      let body = pattern[0] === BOM ? pattern.slice(1) : pattern;
+      if (body[0] === "#") {
+        return;
+      }
+      let negative = false;
+      if (body[0] === "!") {
+        negative = true;
+        body = body.slice(1);
+      }
+      const last = body[body.length - 1];
+      if (last === SPACE || last === "\r" || last === "\n") {
+        body = trimEnd(body);
+      }
+      if (!body) {
+        return;
+      }
+      body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
+      const regexPrefix = makeRegexPrefix(body);
+      return new IgnoreRule(
+        pattern,
+        mark,
+        body,
+        ignoreCase,
+        negative,
+        regexPrefix
+      );
+    };
+    var RuleManager = class {
+      constructor(ignoreCase) {
+        this._ignoreCase = ignoreCase;
+        this._rules = [];
+        this._basenameCount = 0;
+      }
+      _add(pattern) {
+        if (pattern && pattern[KEY_IGNORE]) {
+          this._rules = this._rules.concat(pattern._rules._rules);
+          this._basenameCount += pattern._rules._basenameCount;
+          this._added = true;
+          return;
+        }
+        if (isString(pattern)) {
+          pattern = {
+            pattern
+          };
+        }
+        const rule = checkPattern(pattern.pattern) && createRule(pattern, this._ignoreCase);
+        if (rule) {
+          this._added = true;
+          this._rules.push(rule);
+          if (matchesBasename(rule.body)) {
+            this._basenameCount++;
+          }
+        }
+      }
+      // @param {Array<string> | string | Ignore} pattern
+      add(pattern) {
+        this._added = false;
+        makeArray(
+          isString(pattern) ? splitPattern(pattern) : pattern
+        ).forEach(this._add, this);
+        if (this._added) {
+          this._literalRules = UNDEFINED;
+        }
+        return this._added;
+      }
+      // Match the literal 'abc/' for `checkIgnore`, last rule wins. Only a rule
+      //   ending in a wildcard can match it (see `checkSourceOf`), so the rest
+      //   are left out once, rather than tested or compiled for every path.
+      testLiteral(path) {
+        const rules = this._literalRules || (this._literalRules = this._rules.filter(
+          ({ body }) => body[body.length - (body[body.length - 1] === SLASH ? 2 : 1)] === "*"
+        ));
+        let ignored = false;
+        let unignored = false;
+        let matchedRule;
+        for (let index = rules.length - 1; index >= 0; index--) {
+          const rule = rules[index];
+          if (rule.checkRegex.test(path)) {
+            ignored = !rule.negative;
+            unignored = rule.negative;
+            matchedRule = rule.negative ? UNDEFINED : rule;
+            break;
+          }
+        }
+        const ret = {
+          ignored,
+          unignored
+        };
+        if (matchedRule) {
+          ret.rule = matchedRule;
+        }
+        return ret;
+      }
+      // Test one single path without recursively checking parent directories
+      //
+      // - checkUnignored `boolean` whether should check if the path is unignored,
+      //   setting `checkUnignored` to `false` could reduce additional
+      //   path matching.
+      // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
+      // @returns {TestResult} true if a file is ignored
+      test(path, checkUnignored, mode) {
+        let ignored = false;
+        let unignored = false;
+        let matchedRule;
+        const rules = this._rules;
+        const { length } = rules;
+        const shortcut = this._basenameCount * 2 >= length;
+        const basename = shortcut ? basenameOf(path) : path;
+        for (let index = 0; index < length; index++) {
+          const rule = rules[index];
+          const { negative } = rule;
+          const skip = unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored;
+          if (!skip && rule[mode].test(
+            shortcut && rule._basenameOnly ? basename : path
+          )) {
+            ignored = !negative;
+            unignored = negative;
+            matchedRule = negative ? UNDEFINED : rule;
+          }
+        }
+        const ret = {
+          ignored,
+          unignored
+        };
+        if (matchedRule) {
+          ret.rule = matchedRule;
+        }
+        return ret;
+      }
+    };
+    var throwError = (message, Ctor) => {
+      throw new Ctor(message);
+    };
+    var checkPath = (path, originalPath, doThrow) => {
+      if (!isString(path)) {
+        return doThrow(
+          `path must be a string, but got \`${originalPath}\``,
+          TypeError
+        );
+      }
+      if (!path) {
+        return doThrow(`path must not be empty`, TypeError);
+      }
+      if (checkPath.isNotRelative(path)) {
+        const r = "`path.relative()`d";
+        return doThrow(
+          `path should be a ${r} string, but got "${originalPath}"`,
+          RangeError
+        );
+      }
+      return true;
+    };
+    var isNotRelative = (path) => {
+      const first = path.charCodeAt(0);
+      if (first === SLASH_CODE) {
+        return true;
+      }
+      if (first !== DOT_CODE) {
+        return false;
+      }
+      if (path.length === 1) {
+        return true;
+      }
+      const second = path.charCodeAt(1);
+      if (second === SLASH_CODE) {
+        return true;
+      }
+      if (second !== DOT_CODE) {
+        return false;
+      }
+      return path.length === 2 || path.charCodeAt(2) === SLASH_CODE;
+    };
+    checkPath.isNotRelative = isNotRelative;
+    checkPath.convert = (p) => p;
+    var Ignore = class {
+      constructor({
+        ignorecase = true,
+        ignoreCase = ignorecase,
+        allowRelativePaths = false
+      } = {}) {
+        define(this, KEY_IGNORE, true);
+        this._rules = new RuleManager(ignoreCase);
+        this._strictPathCheck = !allowRelativePaths;
+        this._initCache();
+      }
+      _initCache() {
+        this._ignoreCache = /* @__PURE__ */ Object.create(null);
+        this._testCache = /* @__PURE__ */ Object.create(null);
+      }
+      add(pattern) {
+        if (this._rules.add(pattern)) {
+          this._initCache();
+        }
+        return this;
+      }
+      // legacy
+      addPattern(pattern) {
+        return this.add(pattern);
+      }
+      // @returns {TestResult}
+      _test(originalPath, cache, checkUnignored) {
+        const path = originalPath && checkPath.convert(originalPath);
+        checkPath(
+          path,
+          originalPath,
+          this._strictPathCheck ? throwError : RETURN_FALSE
+        );
+        return this._t(path, cache, checkUnignored);
+      }
+      checkIgnore(path) {
+        if (path.charCodeAt(path.length - 1) !== SLASH_CODE) {
+          return this.test(path);
+        }
+        const dir = this._t(path, this._testCache, true);
+        if (dir.ignored) {
+          return dir;
+        }
+        const literal = this._rules.testLiteral(path);
+        return literal.ignored || literal.unignored ? literal : dir;
+      }
+      _t(path, cache, checkUnignored) {
+        if (path in cache) {
+          return cache[path];
+        }
+        const parentPath = parentOf(path);
+        const parent = parentPath ? this._t(parentPath, cache, checkUnignored) : UNDEFINED;
+        return cache[path] = parent && parent.ignored ? parent : this._rules.test(path, checkUnignored, MODE_IGNORE);
+      }
+      ignores(path) {
+        return this._test(path, this._ignoreCache, false).ignored;
+      }
+      createFilter() {
+        return (path) => !this.ignores(path);
+      }
+      filter(paths) {
+        return makeArray(paths).filter(this.createFilter());
+      }
+      // @returns {TestResult}
+      test(path) {
+        return this._test(path, this._testCache, true);
+      }
+    };
+    var factory = (options) => new Ignore(options);
+    var isPathValid = (path) => checkPath(path && checkPath.convert(path), path, RETURN_FALSE);
+    var setupWindows = () => {
+      const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
+      checkPath.convert = makePosix;
+      const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
+      checkPath.isNotRelative = (path) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path) || isNotRelative(path);
+    };
+    if (
+      // Detect `process` so that it can run in browsers.
+      typeof process !== "undefined" && process.platform === "win32"
+    ) {
+      setupWindows();
+    }
+    module.exports = factory;
+    factory.default = factory;
+    module.exports.isPathValid = isPathValid;
+    define(module.exports, /* @__PURE__ */ Symbol.for("setupWindows"), setupWindows);
+  }
+});
+
+// packages/shared/dist/logger.js
+var debug;
+var init_logger = __esm({
+  "packages/shared/dist/logger.js"() {
+    "use strict";
+    debug = (_msg, _ctx) => {
+    };
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+function pathsFor(platform) {
+  return platform === "win32" ? win32 : posix;
+}
+function mnemonikStateDirectory(platform = process.platform, env = process.env, home = homedir()) {
+  if (env.MNEMONIK_STATE_DIR)
+    return env.MNEMONIK_STATE_DIR;
+  if (platform === "win32")
+    return win32.join(env.LOCALAPPDATA || win32.join(home, "AppData", "Local"), "Mnemonik");
+  if (platform === "darwin")
+    return posix.join(home, "Library", "Application Support", "Mnemonik");
+  return posix.join(env.XDG_STATE_HOME || posix.join(home, ".local", "state"), "mnemonik");
+}
+function protectedLocalPaths(platform = process.platform, env = process.env, home = homedir()) {
+  const path = pathsFor(platform);
+  const localAppData = env.LOCALAPPDATA || win32.join(home, "AppData", "Local");
+  const appData = env.APPDATA || win32.join(home, "AppData", "Roaming");
+  const state = mnemonikStateDirectory(platform, env, home);
+  const common = [
+    state,
+    path.join(home, ".mnemonik"),
+    path.join(home, ".claude", ".credentials.json"),
+    path.join(home, ".codex", "auth.json"),
+    path.join(home, ".cursor", "mcp.json"),
+    path.join(home, ".grok", "mcp_credentials.json")
+  ];
+  const osPaths = platform === "darwin" ? [path.join(home, "Library", "Keychains")] : platform === "win32" ? [
+    win32.join(appData, "Microsoft", "Credentials"),
+    win32.join(localAppData, "Microsoft", "Credentials"),
+    win32.join(appData, "Microsoft", "Protect")
+  ] : [
+    path.join(home, ".local", "share", "keyrings"),
+    path.join(home, ".gnupg"),
+    path.join(home, ".ssh"),
+    path.join(home, ".aws"),
+    path.join(home, ".config", "gcloud"),
+    path.join(home, ".docker", "config.json"),
+    path.join(home, ".npmrc"),
+    path.join(home, ".netrc"),
+    path.join(home, ".pypirc")
+  ];
+  return [.../* @__PURE__ */ new Set([...common, ...osPaths])];
+}
+function comparable(value, platform) {
+  const path = pathsFor(platform);
+  const normalized = path.resolve(value);
+  return platform === "win32" || platform === "darwin" ? normalized.toLowerCase() : normalized;
+}
+function isProtectedLocalPath(candidate, protectedPaths = protectedLocalPaths(), platform = process.platform) {
+  const path = pathsFor(platform);
+  const target = comparable(candidate, platform);
+  return protectedPaths.some((protectedPath) => {
+    const parent = comparable(protectedPath, platform);
+    const relative2 = path.relative(parent, target);
+    return relative2 === "" || !relative2.startsWith(`..${path.sep}`) && relative2 !== ".." && !path.isAbsolute(relative2);
+  });
+}
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record = value;
+  if (record.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record.schemaVersion };
+  }
+  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record && typeof record.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record.projectId,
+      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
+      ...repositoryFingerprint ? { repositoryFingerprint } : {}
+    }
+  };
+}
+function isConfigurationOnly(text) {
+  try {
+    const value = JSON.parse(text);
+    return !!value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1);
+  } catch {
+    return false;
+  }
+}
+async function readIdentityFile(dir, options = {}) {
+  const path = join(dir, ".mnemonik.json");
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink())
+      return { kind: "malformed", detail: "symlink" };
+    if (!stat.isFile())
+      return { kind: "malformed", detail: "identity path is not a regular file" };
+    const text = await readFile(path, "utf8");
+    if ((options.selectedRoot || options.configurationOnlyAbsent) && isConfigurationOnly(text))
+      return { kind: "absent" };
+    return parseIdentityFile(text);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
+  }
+}
+var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+    IDENTITY_KEYS = /* @__PURE__ */ new Set([
+      "schemaVersion",
+      "projectId",
+      "projectName",
+      "repositoryFingerprint"
+    ]);
+    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+  }
+});
+
+// packages/shared/dist/indexClassifier.js
+import { posix as posix2 } from "path";
+function isTestOrSpecName(base) {
+  return base.includes(".test.") || base.includes(".spec.");
+}
+function hasGeneratedStemToken(base) {
+  const tokens = base.split(".");
+  if (tokens.length < 2)
+    return false;
+  return tokens.slice(0, -1).some((token) => token.toLowerCase() === "generated");
+}
+function posixPath(relPath) {
+  return relPath.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function softDefaultForDirectory(dirRel) {
+  const path = posixPath(dirRel).replace(/\/+$/, "");
+  if (!path)
+    return null;
+  const withSlash = `${path}/`;
+  for (const { reason, rule, re } of DIRECTORY_RULES) {
+    if (re.test(withSlash))
+      return { reason, rule };
+  }
+  return null;
+}
+function softDefaultForPath(relPath) {
+  const path = posixPath(relPath);
+  if (!path)
+    return null;
+  for (const { reason, rule, re } of DIRECTORY_RULES) {
+    if (re.test(path))
+      return { reason, rule };
+  }
+  const base = posix2.basename(path);
+  if (base.startsWith("._"))
+    return { reason: "binary", rule: "AppleDouble resource fork" };
+  if (!isTestOrSpecName(base)) {
+    if (hasGeneratedStemToken(base))
+      return { reason: "generated", rule: "generated file name" };
+    for (const { rule, re } of GENERATED_BASENAME_RULES) {
+      if (re.test(base))
+        return { reason: "generated", rule };
+    }
+  }
+  if (CHANGELOG_UPPER.test(base) || CHANGELOG_DOC.test(base)) {
+    return { reason: "changelog", rule: "changelog file" };
+  }
+  return null;
+}
+function generatedByHeader(content) {
+  const lines = content.split("\n", HEADER_LINES);
+  let generation = false;
+  let doNotEdit = false;
+  for (const raw of lines) {
+    const line = raw.replace(/\r$/, "");
+    if (GO_GENERATED_HEADER.test(line))
+      return "Go generated-code header";
+    if (!COMMENT_LINE.test(line))
+      continue;
+    if (AT_GENERATED.test(line))
+      return "@generated marker";
+    if (GENERATION_PHRASE.test(line))
+      generation = true;
+    if (DO_NOT_EDIT_PHRASE.test(line))
+      doNotEdit = true;
+  }
+  return generation && doNotEdit ? "generated + do-not-edit header" : null;
+}
+function utf8Length(line) {
+  if (line.length * 3 <= MINIFIED_LONG_LINE_BYTES)
+    return line.length;
+  return Buffer.byteLength(line, "utf8");
+}
+function minified(relPath, content) {
+  if (PROSE_EXTENSION.test(relPath))
+    return null;
+  const lines = content.split("\n");
+  let longLines = 0;
+  let total = 0;
+  for (const line of lines) {
+    total += line.length;
+    if (line.length > MINIFIED_LONG_LINE_BYTES / 3 && utf8Length(line) > MINIFIED_LONG_LINE_BYTES) {
+      longLines++;
+      if (longLines > 1)
+        return "two or more lines over 4,096 bytes";
+    }
+  }
+  if (MINIFIABLE_EXTENSION.test(relPath) && lines.length > 0) {
+    const average = total / lines.length;
+    if (average > MINIFIED_AVERAGE_LINE_LENGTH)
+      return "average line length over 110";
+  }
+  return null;
+}
+function dataDump(relPath, content) {
+  if (!/\.sql$/i.test(relPath))
+    return null;
+  if (/(^|\/)migrations\//i.test(posixPath(relPath)))
+    return null;
+  if (COPY_FROM_STDIN.test(content))
+    return "SQL COPY ... FROM stdin";
+  let inserts = 0;
+  INSERT_INTO.lastIndex = 0;
+  while (INSERT_INTO.exec(content) !== null) {
+    if (++inserts >= DATA_DUMP_INSERT_THRESHOLD)
+      return "SQL with 50+ INSERT INTO statements";
+  }
+  return null;
+}
+function softDefaultForContent(relPath, content) {
+  if (content.slice(0, BINARY_SNIFF_BYTES).includes("\0")) {
+    return { reason: "binary", rule: "NUL byte in the first 8,000 bytes" };
+  }
+  const header = generatedByHeader(content);
+  if (header)
+    return { reason: "generated", rule: header };
+  const minifiedRule = minified(relPath, content);
+  if (minifiedRule)
+    return { reason: "minified", rule: minifiedRule };
+  const dump = dataDump(relPath, content);
+  if (dump)
+    return { reason: "data_dump", rule: dump };
+  return null;
+}
+function escapeRegex(char) {
+  return /[.+^${}()|[\]\\*?/]/.test(char) ? `\\${char}` : char;
+}
+function globToRegex(glob) {
+  let re = "";
+  let i = 0;
+  while (i < glob.length) {
+    if (glob.startsWith("**", i)) {
+      const atSegmentStart = i === 0 || glob[i - 1] === "/";
+      const next = glob[i + 2];
+      if (atSegmentStart && next === "/") {
+        re += "(?:.*/)?";
+        i += 3;
+        continue;
+      }
+      if (atSegmentStart && next === void 0) {
+        re += ".*";
+        i += 2;
+        continue;
+      }
+      re += "[^/]*";
+      i += 2;
+      continue;
+    }
+    const char = glob[i];
+    if (char === "*") {
+      re += "[^/]*";
+    } else if (char === "?") {
+      re += "[^/]";
+    } else if (char === "[") {
+      const close = glob.indexOf("]", i + 2);
+      if (close === -1) {
+        re += "\\[";
+      } else {
+        let body = glob.slice(i + 1, close);
+        if (body.startsWith("!"))
+          body = `^${body.slice(1)}`;
+        re += `[${body.replace(/\\/g, "\\\\")}]`;
+        i = close;
+      }
+    } else if (char === "\\" && i + 1 < glob.length) {
+      re += escapeRegex(glob[i + 1]);
+      i++;
+    } else {
+      re += escapeRegex(char);
+    }
+    i++;
+  }
+  return new RegExp(`^${re}$`);
+}
+function splitAttributesLine(line) {
+  let pattern;
+  let rest;
+  if (line.startsWith('"')) {
+    let i = 1;
+    let out = "";
+    for (; i < line.length && line[i] !== '"'; i++) {
+      if (line[i] === "\\" && i + 1 < line.length) {
+        i++;
+        out += line[i] === "t" ? "	" : line[i] === "n" ? "\n" : line[i];
+      } else {
+        out += line[i];
+      }
+    }
+    if (i >= line.length)
+      return null;
+    pattern = out;
+    rest = line.slice(i + 1);
+  } else {
+    const match = /^(\S+)(.*)$/.exec(line);
+    if (!match)
+      return null;
+    pattern = match[1];
+    rest = match[2];
+  }
+  return { pattern, attrs: rest.split(/\s+/).filter(Boolean) };
+}
+function parseGitattributes(text) {
+  const rules = [];
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#") || line.startsWith("[attr]"))
+      continue;
+    const split = splitAttributesLine(line);
+    if (!split || split.pattern.startsWith("!"))
+      continue;
+    let { pattern } = split;
+    if (pattern.endsWith("/"))
+      continue;
+    const attrs = /* @__PURE__ */ new Map();
+    for (const token of split.attrs) {
+      if (token.startsWith("-"))
+        attrs.set(token.slice(1), false);
+      else if (token.startsWith("!"))
+        attrs.set(token.slice(1), void 0);
+      else if (token.includes("=")) {
+        const eq = token.indexOf("=");
+        attrs.set(token.slice(0, eq), token.slice(eq + 1));
+      } else
+        attrs.set(token, true);
+    }
+    if (attrs.get("binary") === true)
+      attrs.set("text", false);
+    if (attrs.size === 0)
+      continue;
+    const basenameOnly = !pattern.includes("/");
+    if (pattern.startsWith("/"))
+      pattern = pattern.slice(1);
+    rules.push({ re: globToRegex(pattern), basenameOnly, attrs });
+  }
+  return rules;
+}
+function booleanAttribute(value) {
+  if (value === true || value === "true")
+    return true;
+  if (value === false || value === "false")
+    return false;
+  return void 0;
+}
+function linguistAttributesFor(relPath, layers) {
+  const path = posixPath(relPath);
+  const state = /* @__PURE__ */ new Map();
+  const ordered = [...layers].sort((a, b) => depthOf(a.baseRel) - depthOf(b.baseRel));
+  for (const layer of ordered) {
+    let sub;
+    if (layer.baseRel === "")
+      sub = path;
+    else if (path.startsWith(`${layer.baseRel}/`))
+      sub = path.slice(layer.baseRel.length + 1);
+    else
+      continue;
+    const base = posix2.basename(sub);
+    for (const rule of layer.rules) {
+      if (!(rule.basenameOnly ? rule.re.test(base) : rule.re.test(sub)))
+        continue;
+      for (const [name, value] of rule.attrs)
+        state.set(name, value);
+    }
+  }
+  return {
+    vendored: booleanAttribute(state.get("linguist-vendored")),
+    generated: booleanAttribute(state.get("linguist-generated")),
+    binary: state.get("text") === false
+  };
+}
+function depthOf(baseRel) {
+  return baseRel === "" ? 0 : baseRel.split("/").length;
+}
+function gitattributesCanReinclude(layers) {
+  return layers.some((layer) => layer.rules.some((rule) => ["linguist-vendored", "linguist-generated"].some((name) => booleanAttribute(rule.attrs.get(name)) === false)));
+}
+function classifyForIndex(relPath, options = {}) {
+  if (options.ignoreFileVerdict === "unignored")
+    return { include: true, override: "ignore_file" };
+  if (options.attributes && options.attributes.length > 0) {
+    const attrs = linguistAttributesFor(relPath, options.attributes);
+    if (attrs.vendored === true) {
+      return { include: false, reason: "vendored", rule: ".gitattributes linguist-vendored" };
+    }
+    if (attrs.generated === true) {
+      return { include: false, reason: "generated", rule: ".gitattributes linguist-generated" };
+    }
+    if (attrs.binary)
+      return { include: false, reason: "binary", rule: ".gitattributes binary" };
+    if (attrs.vendored === false || attrs.generated === false) {
+      return { include: true, override: "gitattributes" };
+    }
+  }
+  const byPath = softDefaultForPath(relPath);
+  if (byPath)
+    return { include: false, ...byPath };
+  if (options.content !== void 0) {
+    const byContent = softDefaultForContent(relPath, options.content);
+    if (byContent)
+      return { include: false, ...byContent };
+  }
+  return { include: true };
+}
+var DIRECTORY_RULES, GENERATED_BASENAME_RULES, CHANGELOG_UPPER, CHANGELOG_DOC, BINARY_SNIFF_BYTES, HEADER_LINES, MINIFIED_AVERAGE_LINE_LENGTH, MINIFIED_LONG_LINE_BYTES, DATA_DUMP_INSERT_THRESHOLD, MINIFIABLE_EXTENSION, PROSE_EXTENSION, COMMENT_LINE, GO_GENERATED_HEADER, AT_GENERATED, GENERATION_PHRASE, DO_NOT_EDIT_PHRASE, INSERT_INTO, COPY_FROM_STDIN;
+var init_indexClassifier = __esm({
+  "packages/shared/dist/indexClassifier.js"() {
+    "use strict";
+    DIRECTORY_RULES = [
+      // R2 - vendored dependencies and archive debris.
+      {
+        reason: "vendored",
+        rule: "vendored directory",
+        re: /(^|\/)(vendors?|Vendor|third[-_]?party|3rd[-_]?party|Godeps|Carthage|jspm_packages|site-packages|dist-packages|__MACOSX)\//
+      },
+      {
+        reason: "vendored",
+        rule: "Yarn release/plugin/cache directory",
+        re: /(^|\/)\.yarn\/(releases|plugins|sdks|versions|unplugged|cache)\//
+      },
+      { reason: "vendored", rule: "documentation build output", re: /(^|\/)docs?\/_?build\// },
+      // Test fixtures are copies of other code: byte-identical snapshot trees
+      // stole the content-hash dedup slot from the real file and outranked it in
+      // code_search. This folds in the old built-in `/tests/fixtures/*` pattern.
+      { reason: "vendored", rule: "test fixtures", re: /(^|\/)([Tt]ests?|[Ss]pecs?)\/fixtures\// },
+      { reason: "vendored", rule: "test fixtures", re: /(^|\/)(testdata|__fixtures__)\// },
+      { reason: "vendored", rule: "test snapshots", re: /(^|\/)__snapshots__\// },
+      // R3 - generated output directories.
+      {
+        reason: "generated",
+        rule: "generated directory",
+        re: /(^|\/)(__generated__|_generated|generated|autogen)\//
+      }
+    ];
+    GENERATED_BASENAME_RULES = [
+      // Infixes: foo.gen.ts, foo.g.dart, foo.pb.go, foo.pb.gw.go, foo.freezed.dart,
+      // Form1.Designer.cs. Case-insensitive: Visual Studio writes `.Designer.cs`.
+      { rule: "generated infix", re: /\.(gen|g|pb|pb\.gw|freezed|designer)\.[^.]+$/i },
+      // Protocol Buffers / gRPC outputs.
+      { rule: "protobuf/gRPC output", re: /_pb2(_grpc)?\.pyi?$/ },
+      { rule: "protobuf/gRPC output", re: /_pb\.(js|ts)$/ },
+      { rule: "protobuf/gRPC output", re: /_grpc_pb\..+$/ },
+      { rule: "protobuf/gRPC output", re: /_grpc\.pb\.go$/ },
+      { rule: "protobuf/gRPC output", re: /\.pb\.(go|cc|h|swift|dart|ts|js)$/ },
+      // SpecFlow, Yarn Plug'n'Play, Delphi type libraries.
+      { rule: "SpecFlow feature binding", re: /\.feature\.cs$/ },
+      { rule: "Yarn Plug'n'Play loader", re: /^\.pnp\./ },
+      { rule: "Delphi type library", re: /_tlb\.pas$/ }
+    ];
+    CHANGELOG_UPPER = /^(CHANGELOG|CHANGES|HISTORY|NEWS)(\.[^/]*)?$/;
+    CHANGELOG_DOC = /^(changelog|changes|history|news)(\.(md|markdown|rst|txt|adoc))?$/i;
+    BINARY_SNIFF_BYTES = 8e3;
+    HEADER_LINES = 10;
+    MINIFIED_AVERAGE_LINE_LENGTH = 110;
+    MINIFIED_LONG_LINE_BYTES = 4096;
+    DATA_DUMP_INSERT_THRESHOLD = 50;
+    MINIFIABLE_EXTENSION = /\.(js|mjs|cjs|css)$/i;
+    PROSE_EXTENSION = /\.(md|mdc|mdx|markdown)$/i;
+    COMMENT_LINE = /^\s*(\/\/|\/\*|\*|#|--|;|<!--|%|\(\*|\{-|"""|''')/;
+    GO_GENERATED_HEADER = /^\/\/ Code generated .* DO NOT EDIT\.$/;
+    AT_GENERATED = /@generated\b/;
+    GENERATION_PHRASE = /\b(generated by|auto-generated|autogenerated|this file was generated|code generated)\b/i;
+    DO_NOT_EDIT_PHRASE = /\b(do not edit|do not modify|manual changes will be overwritten)\b/i;
+    INSERT_INTO = /\binsert\s+into\b/gi;
+    COPY_FROM_STDIN = /^\s*COPY\s+[^\n]*\bFROM\s+stdin\b/im;
+  }
+});
+
+// packages/shared/dist/fileSelection.js
+var fileSelection_exports = {};
+__export(fileSelection_exports, {
+  AUTHORITY_FILE_MATCHERS: () => AUTHORITY_FILE_MATCHERS,
+  BUILT_IN_IGNORE_DIRS: () => BUILT_IN_IGNORE_DIRS,
+  BUILT_IN_IGNORE_FILE_PATTERNS: () => BUILT_IN_IGNORE_FILE_PATTERNS,
+  CMAKE_LISTS_PATH: () => CMAKE_LISTS_PATH,
+  DEFAULT_IGNORE_PATTERNS: () => DEFAULT_IGNORE_PATTERNS,
+  DEFAULT_INCLUDE_EXTENSIONS: () => DEFAULT_INCLUDE_EXTENSIONS,
+  FIXTURE_PATH_RE: () => FIXTURE_PATH_RE,
+  FileSelector: () => FileSelector,
+  XCODE_AUTHORITY_PATH: () => XCODE_AUTHORITY_PATH,
+  enterDirectory: () => enterDirectory,
+  fileOp: () => fileOp,
+  isAuthorityOnlyPath: () => isAuthorityOnlyPath,
+  isCmakeListsPath: () => isCmakeListsPath,
+  isCursorRulePath: () => isCursorRulePath,
+  isFixturePath: () => isFixturePath,
+  isGitBoundary: () => isGitBoundary,
+  isLinkedWorktreeCheckout: () => isLinkedWorktreeCheckout,
+  isProjectBoundary: () => isProjectBoundary,
+  isSecretFile: () => isSecretFile,
+  isXcodeAuthorityPath: () => isXcodeAuthorityPath,
+  languageForExtension: () => languageForExtension,
+  makeIgnoreMatcher: () => makeIgnoreMatcher,
+  markUnreadable: () => markUnreadable,
+  rootProjectId: () => rootProjectId,
+  statTuple: () => statTuple
+});
+import { readdir, readFile as readFile2, open, lstat as lstat2, realpath } from "fs/promises";
+import { constants } from "fs";
+import { join as join2, relative, extname, sep, resolve, dirname } from "path";
+function timedOp(op, timeoutMs, label) {
+  let timer;
+  return Promise.race([
+    op,
+    new Promise((_resolve, reject) => {
+      timer = setTimeout(() => reject(new FileOpTimeoutError(label, timeoutMs)), timeoutMs);
+    })
+  ]).finally(() => clearTimeout(timer));
+}
+async function fileOp(op, label, budgets = {
+  first: FILE_OP_TIMEOUT_MS,
+  retry: FILE_OP_RETRY_TIMEOUT_MS
+}) {
+  try {
+    return await timedOp(op(), budgets.first, label);
+  } catch (error) {
+    if (!(error instanceof FileOpTimeoutError))
+      throw error;
+    return timedOp(op(), budgets.retry, label);
+  }
+}
+function statTuple(stats) {
+  return { size: stats.size, mtimeMs: stats.mtimeMs, ctimeMs: stats.ctimeMs, ino: stats.ino };
+}
+function markUnreadable(walk, path, error) {
+  walk.complete = false;
+  walk.unreadable = (walk.unreadable ?? 0) + 1;
+  walk.unreadableSamples ??= [];
+  if (walk.unreadableSamples.length < UNREADABLE_SAMPLES)
+    walk.unreadableSamples.push({
+      path,
+      reason: error?.code ?? (error instanceof Error ? error.message : "unreadable")
+    });
+}
+async function directoryKey(path) {
+  const stats = await lstat2(path, { bigint: true });
+  return stats.ino ? `${stats.dev}:${stats.ino}` : null;
+}
+async function enterDirectory(walk, path) {
+  let key;
+  try {
+    key = await directoryKey(path);
+  } catch {
+    key = null;
+  }
+  if (key === null)
+    return () => void 0;
+  walk.ancestors ??= /* @__PURE__ */ new Set();
+  if (walk.ancestors.has(key)) {
+    markUnreadable(walk, path, Object.assign(new Error("directory cycle"), { code: "ELOOP" }));
+    return null;
+  }
+  const entered = key;
+  walk.ancestors.add(entered);
+  return () => {
+    walk.ancestors?.delete(entered);
+  };
+}
+function isSecretFile(relPath) {
+  if (!relPath)
+    return false;
+  const segments = relPath.split(sep).join("/").split("/");
+  const base = segments[segments.length - 1] ?? "";
+  if (!base || SECRET_FILE_PLACEHOLDER_BASENAMES.has(base))
+    return false;
+  if (SECRET_FILE_BASENAME_PATTERNS.some((re) => re.test(base)))
+    return true;
+  const parent = segments[segments.length - 2];
+  return base === "credentials" && parent !== void 0 && parent.startsWith(".");
+}
+function isCursorRulePath(relPath) {
+  if (!relPath)
+    return false;
+  const posix3 = relPath.split(sep).join("/");
+  return /(^|\/)\.cursorrules$/.test(posix3) || /(^|\/)\.cursor\/rules\/.+\.mdc$/.test(posix3);
+}
+function languageForExtension(filePathOrExt) {
+  if (isCmakeListsPath(filePathOrExt))
+    return "cmake";
+  const fromPath = EXTENSION_LANGUAGES[extname(filePathOrExt).toLowerCase()];
+  if (fromPath !== void 0)
+    return fromPath;
+  return EXTENSION_LANGUAGES[filePathOrExt.toLowerCase()] ?? "unknown";
+}
+function isAuthorityOnlyPath(relPath) {
+  if (!relPath)
+    return false;
+  const posix3 = relPath.split(sep).join("/");
+  return AUTHORITY_ONLY_PATH_PREDICATES.some((matches) => matches(posix3));
+}
+function isFixturePath(path) {
+  return FIXTURE_PATH_RE.test(path);
+}
+function makeIgnoreMatcher(extraPatterns = []) {
+  const cleaned = extraPatterns.filter((p) => typeof p === "string" && p.trim().length > 0);
+  const ig = cleaned.length > 0 ? (0, import_ignore.default)().add([...cleaned]) : null;
+  return (relPath) => {
+    if (!relPath)
+      return false;
+    const norm = relPath.split(sep).join("/");
+    if (norm.split("/").some((s) => BUILT_IN_IGNORE_DIR_SET.has(s)))
+      return true;
+    if (isSecretFile(norm))
+      return true;
+    if (ig) {
+      try {
+        return ig.ignores(norm);
+      } catch {
+        return false;
+      }
+    }
+    return false;
+  };
+}
+async function isGitBoundary(dirPath) {
+  try {
+    await fileOp(() => lstat2(join2(dirPath, ".git")), `lstat: ${join2(dirPath, ".git")}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isProjectBoundary(dirPath, enclosingProjectId) {
+  if (await lstatWithin(join2(dirPath, ".mnemonik.json"))) {
+    const identity = await fileOp(() => readIdentityFile(dirPath, { configurationOnlyAbsent: true }), `identity read: ${dirPath}`).catch(() => void 0);
+    if (!identity)
+      return true;
+    if (identity.kind === "ok") {
+      if (identity.identity.projectId !== enclosingProjectId)
+        return true;
+      if ((await lstatWithin(join2(dirPath, ".git")))?.isDirectory())
+        return true;
+    } else if (identity.kind !== "absent")
+      return true;
+  }
+  return isLinkedWorktreeCheckout(dirPath);
+}
+async function rootProjectId(rootPath) {
+  const identity = await fileOp(() => readIdentityFile(rootPath), `identity read: ${rootPath}`).catch(() => void 0);
+  return identity?.kind === "ok" ? identity.identity.projectId : void 0;
+}
+async function isLinkedWorktreeCheckout(dirPath) {
+  const marker = await lstatWithin(join2(dirPath, ".git"));
+  if (!marker?.isFile())
+    return false;
+  try {
+    const pointer = /^gitdir:\s*(.+?)\s*$/im.exec(await fileOp(() => readFile2(join2(dirPath, ".git"), "utf8"), `read: ${join2(dirPath, ".git")}`))?.[1];
+    if (!pointer)
+      return false;
+    const gitDirectory = resolve(dirPath, pointer);
+    if (!await lstatWithin(gitDirectory))
+      return true;
+    return !!await lstatWithin(join2(gitDirectory, "commondir"));
+  } catch {
+    return false;
+  }
+}
+var import_ignore, FILE_OP_TIMEOUT_MS, FILE_OP_RETRY_TIMEOUT_MS, FileOpTimeoutError, UNREADABLE_SAMPLES, BUILT_IN_IGNORE_DIRS, BUILT_IN_IGNORE_FILE_PATTERNS, SECRET_FILE_PLACEHOLDER_BASENAMES, SECRET_FILE_BASENAME_PATTERNS, IGNORE_FILE_NAMES, ATTRIBUTES_FILE_NAME, DEFAULT_INCLUDE_EXTENSIONS, EXTENSION_LANGUAGES, isMigrationSqlAuthorityPath, XCODE_AUTHORITY_PATH, isXcodeAuthorityPath, CMAKE_LISTS_PATH, isCmakeListsPath, AUTHORITY_ONLY_PATH_PREDICATES, AUTHORITY_FILE_MATCHERS, FIXTURE_PATH_RE, BUILT_IN_IGNORE_DIR_SET, lstatWithin, DEFAULT_IGNORE_PATTERNS, FileSelector;
+var init_fileSelection = __esm({
+  "packages/shared/dist/fileSelection.js"() {
+    "use strict";
+    import_ignore = __toESM(require_ignore(), 1);
+    init_logger();
+    init_protectedPaths();
+    init_projectIdentityFile();
+    init_indexClassifier();
+    FILE_OP_TIMEOUT_MS = 5e3;
+    FILE_OP_RETRY_TIMEOUT_MS = 3e4;
+    FileOpTimeoutError = class extends Error {
+      constructor(label, timeoutMs) {
+        super(`${label} timed out after ${timeoutMs} ms`);
+        this.name = "FileOpTimeoutError";
+      }
+    };
+    UNREADABLE_SAMPLES = 5;
+    BUILT_IN_IGNORE_DIRS = [
+      // JS / web
+      "node_modules",
+      ".next",
+      ".nuxt",
+      ".output",
+      "dist",
+      "build",
+      "coverage",
+      ".turbo",
+      ".vercel",
+      ".svelte-kit",
+      ".angular",
+      ".astro",
+      ".parcel-cache",
+      "bower_components",
+      // Python
+      "venv",
+      ".venv",
+      "env",
+      "__pycache__",
+      ".tox",
+      ".mypy_cache",
+      ".pytest_cache",
+      ".ruff_cache",
+      // Native mobile - iOS / Android / React Native / Flutter (2026-07-11 Pods incident)
+      "Pods",
+      "DerivedData",
+      ".gradle",
+      ".expo",
+      ".dart_tool",
+      // Infra / cloud
+      ".terraform",
+      "cdk.out",
+      ".serverless",
+      // Build systems, caches, VCS
+      "target",
+      "bin",
+      "obj",
+      ".cache",
+      ".git",
+      ".svn",
+      ".hg",
+      // The coding agent's captured shell environment, written as .sh files.
+      // Harmless while only source extensions were collected; the moment shell
+      // scripts became collectable these scanned as project code, which would put
+      // an agent's own shell state into the user's searchable memory.
+      //
+      // Scoped to this one directory name deliberately. `.claude/` at large holds
+      // real project content - `.claude/rules.md` is indexed on purpose
+      // (tests/CodeScannerIgnorePatterns.test.ts), and only `.claude/worktrees/`
+      // is suppressed, by the generic nested-git-boundary rule.
+      "shell-snapshots"
+    ];
+    BUILT_IN_IGNORE_FILE_PATTERNS = [
+      // NOTE: the `.env` family and every other secret-bearing FILE KIND lives in
+      // `isSecretFile` below, not here. This glob engine cannot express negation
+      // (`.env.example` must stay collectable) and its unanchored substring
+      // matching would make `.env.*` also swallow `.environment.ts`.
+      //
+      // `/tests/fixtures/*` used to live here. It is now a soft default in
+      // indexClassifier.ts (test fixtures, R2), which a project can re-include.
+      ".DS_Store",
+      "*.log",
+      "*.lock",
+      "package-lock.json",
+      "yarn.lock",
+      "*.min.js",
+      "*.min.css",
+      "*.bundle.js",
+      "*.legacy.js",
+      "*.map"
+    ];
+    SECRET_FILE_PLACEHOLDER_BASENAMES = /* @__PURE__ */ new Set([".env.example"]);
+    SECRET_FILE_BASENAME_PATTERNS = [
+      /^\.env(\..+)?$/i,
+      // .env, .env.local, .env.production.local
+      /^id_(?:rsa|dsa|ecdsa|ed25519)/i,
+      // ssh private keys (and .pub siblings)
+      /^\.(?:npmrc|netrc|pgpass)$/i,
+      // registry / ftp / postgres password files
+      /^kubeconfig$/i,
+      /\.(?:pem|key|p12|pfx|keystore|jks|kubeconfig)$/i,
+      // Terraform variable files: `terraform.tfvars` is the conventional home for
+      // provider credentials, and unlike the entries above nothing else was
+      // keeping it out - it is excluded here rather than merely left off
+      // `DEFAULT_INCLUDE_EXTENSIONS`, so a future widening of the allowlist cannot
+      // quietly opt a project into embedding its own cloud keys.
+      /\.tfvars(\.json)?$/i
+    ];
+    IGNORE_FILE_NAMES = [".gitignore", ".mnemonikignore"];
+    ATTRIBUTES_FILE_NAME = ".gitattributes";
+    DEFAULT_INCLUDE_EXTENSIONS = [
+      ".ts",
+      ".tsx",
+      ".js",
+      ".jsx",
+      ".py",
+      ".rs",
+      ".go",
+      ".java",
+      ".c",
+      ".cpp",
+      ".h",
+      ".cs",
+      ".rb",
+      ".php",
+      ".swift",
+      ".kt",
+      // Shell and Lua are the working languages of whole real projects -
+      // deployment tooling, container entrypoints, imapfilter/nginx/redis
+      // configuration. Omitting them meant such a project indexed ZERO code and
+      // code_search could not answer anything about it, while reporting that as
+      // "no indexed matches" rather than as missing coverage.
+      ".sh",
+      ".bash",
+      ".zsh",
+      ".lua",
+      ".md",
+      // -- Variants of languages already on the list. `.mjs`/`.cjs`/`.mts`/`.cts`/
+      // `.pyi` inherit their language string from a listed extension, so their
+      // absence was oversight rather than policy. The C++ spellings are a choice,
+      // not an inheritance: `.h` stays 'c' (C headers dominate, and reading a C++
+      // header as C is the safer default), while the unambiguously-C++ spellings
+      // resolve to 'cpp'.
+      ".mjs",
+      ".cjs",
+      ".mts",
+      ".cts",
+      ".pyi",
+      ".hpp",
+      ".hh",
+      ".hxx",
+      ".cc",
+      ".cxx",
+      ".kts",
+      // -- Languages the scanner could not read at all.
+      ".dart",
+      ".m",
+      ".mm",
+      ".scala",
+      ".sc",
+      ".ex",
+      ".exs",
+      ".erl",
+      ".hrl",
+      ".hs",
+      ".jl",
+      ".ml",
+      ".mli",
+      ".clj",
+      ".cljs",
+      ".cljc",
+      ".groovy",
+      ".gradle",
+      ".ps1",
+      ".psm1",
+      ".pl",
+      ".pm",
+      ".r",
+      ".sol",
+      ".zig",
+      ".vue",
+      ".svelte",
+      // -- Infrastructure and schema DSLs, where real logic lives and where "how
+      // is this deployed?" and "what does this table hold?" go unanswered today.
+      ".tf",
+      ".sql",
+      ".proto",
+      ".graphql",
+      ".gql",
+      ".cmake",
+      ".nix",
+      ".bzl"
+    ];
+    EXTENSION_LANGUAGES = {
+      ".ts": "typescript",
+      ".tsx": "typescript",
+      ".mts": "typescript",
+      ".cts": "typescript",
+      ".js": "javascript",
+      ".jsx": "javascript",
+      ".mjs": "javascript",
+      ".cjs": "javascript",
+      ".py": "python",
+      ".pyi": "python",
+      ".rs": "rust",
+      ".go": "go",
+      ".java": "java",
+      ".c": "c",
+      ".h": "c",
+      ".cpp": "cpp",
+      ".cc": "cpp",
+      ".cxx": "cpp",
+      ".hpp": "cpp",
+      ".hh": "cpp",
+      ".hxx": "cpp",
+      ".cs": "csharp",
+      ".rb": "ruby",
+      ".php": "php",
+      ".swift": "swift",
+      ".kt": "kotlin",
+      ".kts": "kotlin",
+      ".sh": "shell",
+      ".bash": "shell",
+      ".zsh": "shell",
+      ".lua": "lua",
+      ".md": "markdown",
+      ".dart": "dart",
+      ".m": "objc",
+      ".mm": "objc",
+      ".scala": "scala",
+      ".sc": "scala",
+      ".ex": "elixir",
+      ".exs": "elixir",
+      ".erl": "erlang",
+      ".hrl": "erlang",
+      ".hs": "haskell",
+      ".jl": "julia",
+      ".ml": "ocaml",
+      ".mli": "ocaml",
+      ".clj": "clojure",
+      ".cljs": "clojure",
+      ".cljc": "clojure",
+      ".groovy": "groovy",
+      ".gradle": "groovy",
+      ".ps1": "powershell",
+      ".psm1": "powershell",
+      ".pl": "perl",
+      ".pm": "perl",
+      ".r": "r",
+      ".sol": "solidity",
+      ".zig": "zig",
+      ".vue": "vue",
+      ".svelte": "svelte",
+      ".tf": "terraform",
+      ".sql": "sql",
+      ".proto": "protobuf",
+      ".graphql": "graphql",
+      ".gql": "graphql",
+      ".cmake": "cmake",
+      ".nix": "nix",
+      ".bzl": "starlark"
+    };
+    isMigrationSqlAuthorityPath = (posixRelPath) => /^migrations\/.*\.sql$/.test(posixRelPath);
+    XCODE_AUTHORITY_PATH = /(?:^|\/)[^/]+\.xcodeproj\/project\.pbxproj$|\.xcconfig$/;
+    isXcodeAuthorityPath = (path) => XCODE_AUTHORITY_PATH.test(path);
+    CMAKE_LISTS_PATH = /(?:^|\/)CMakeLists\.txt$/;
+    isCmakeListsPath = (path) => CMAKE_LISTS_PATH.test(path);
+    AUTHORITY_ONLY_PATH_PREDICATES = [
+      isMigrationSqlAuthorityPath,
+      isXcodeAuthorityPath,
+      isCmakeListsPath
+    ];
+    AUTHORITY_FILE_MATCHERS = [
+      (p) => p === "package.json",
+      (p) => /^(packages|apps|services|tools)\/[^/]+\/package\.json$/.test(p),
+      (p) => p === "tsconfig.json" || /^tsconfig\.[^/]+\.json$/.test(p),
+      (p) => p === "pyproject.toml",
+      (p) => p === "requirements.txt",
+      (p) => p === "setup.py",
+      (p) => p === "Cargo.toml",
+      (p) => p === "Gemfile",
+      (p) => p === "Makefile",
+      (p) => p === ".env.example",
+      (p) => /^\.github\/workflows\/[^/]+\.(yml|yaml)$/.test(p),
+      // SQL migrations: the schema_columns authority extractor reads every .sql
+      // under `migrations/` (listFiles('migrations/') -> LIKE 'migrations/%' then
+      // .endsWith('.sql')). Without collecting these, that authority is empty and
+      // every schema_table_enumeration claim falls to unverifiable. Shared with
+      // `AUTHORITY_ONLY_PATH_PREDICATES` by reference, not by a copied regex, so
+      // collection and the chunking exclusion cannot disagree.
+      isMigrationSqlAuthorityPath,
+      isXcodeAuthorityPath,
+      isCmakeListsPath
+    ];
+    FIXTURE_PATH_RE = /(^|\/)tests\/fixtures\//;
+    BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
+    lstatWithin = (path) => fileOp(() => lstat2(path), `lstat: ${path}`).catch(() => void 0);
+    DEFAULT_IGNORE_PATTERNS = [
+      ...BUILT_IN_IGNORE_DIRS,
+      ...BUILT_IN_IGNORE_FILE_PATTERNS
+    ];
+    FileSelector = class _FileSelector {
+      selection;
+      protectedPaths;
+      /** Cumulative observations since this scanner started, including repeated walks. */
+      skipReasons = { symlink_skipped: 0 };
+      skipSymlink(stats) {
+        if (!stats.isSymbolicLink())
+          return false;
+        this.skipReasons.symlink_skipped++;
+        return true;
+      }
+      /**
+       * `includeExtensions` folded to lowercase for matching. The gate used to
+       * compare `extname()` verbatim while `detectLanguage` lowercased, so a
+       * project spelling its files the canonical way - `.R` for R, `.SQL`/`.PS1`
+       * on Windows, `.C`/`.H` in older C trees - indexed zero of them and nothing
+       * said why.
+       */
+      includeExtensionSet;
+      constructor(options = {}) {
+        this.selection = {
+          ignorePatterns: [...DEFAULT_IGNORE_PATTERNS],
+          includeExtensions: [...DEFAULT_INCLUDE_EXTENSIONS],
+          protectedPaths: [],
+          ...options
+        };
+        this.protectedPaths = [
+          .../* @__PURE__ */ new Set([...protectedLocalPaths(), ...options.protectedPaths ?? []])
+        ];
+        this.includeExtensionSet = new Set(this.selection.includeExtensions.map((ext) => ext.toLowerCase()));
+      }
+      isProtected(path) {
+        return isProtectedLocalPath(path, this.protectedPaths);
+      }
+      async isProtectedRead(path) {
+        if (this.isProtected(path))
+          return true;
+        return isProtectedLocalPath(await realpath(path), this.protectedPaths);
+      }
+      /**
+       * The chunkable-file gate, shared by every walker and by the explicit
+       * file-list path so all three agree on what exists. `relPath` is the path
+       * relative to the scan root (OS-native separators accepted).
+       */
+      isChunkable(absOrRelPath, relPath) {
+        if (!this.includeExtensionSet.has(extname(absOrRelPath).toLowerCase()) && !isCursorRulePath(relPath)) {
+          return false;
+        }
+        if (isAuthorityOnlyPath(relPath)) {
+          debug("Skipping chunking for authority-collected path", { relPath });
+          return false;
+        }
+        return true;
+      }
+      /**
+       * Read `.gitignore` + `.mnemonikignore` + `.gitattributes` in `absDir` and
+       * compile them into one layer (the two ignore files are unioned -
+       * `.mnemonikignore` is just an additional gitignore-syntax exclusion list).
+       * Returns null when none of the three exists. FAIL-CLOSED: a non-ENOENT read
+       * error (EISDIR, EACCES, timeout) latches `walk.complete = false` so callers
+       * deriving *removals* from the walk treat it as untrustworthy rather than
+       * silently ignoring nothing.
+       */
+      async loadIgnoreLayer(absDir, baseRel, walk, rootPath) {
+        if (this.isProtected(absDir))
+          return null;
+        const read = async (name) => {
+          const filePath = join2(absDir, name);
+          try {
+            const content = await fileOp(() => this.readConfined(filePath, rootPath), `readFile: ${filePath}`);
+            return content.split(/\r?\n/);
+          } catch (err) {
+            if (err.message === "symlink_skipped")
+              return null;
+            if (err?.code !== "ENOENT") {
+              markUnreadable(walk, filePath, err);
+              debug("Rule-file read failed (fail-closed)", { path: filePath, err });
+            }
+            return null;
+          }
+        };
+        const patterns = [];
+        for (const name of IGNORE_FILE_NAMES) {
+          const lines = await read(name);
+          if (lines)
+            patterns.push(...lines);
+        }
+        const attributeLines = await read(ATTRIBUTES_FILE_NAME) ?? [];
+        if (patterns.length > 0 || attributeLines.length > 0) {
+          walk.rules?.set(baseRel, { ignore: patterns, attributes: attributeLines });
+        }
+        const attributes = attributeLines.length > 0 ? parseGitattributes(attributeLines.join("\n")) : [];
+        if (patterns.length === 0 && attributes.length === 0)
+          return null;
+        return {
+          baseRel,
+          ig: patterns.length > 0 ? (0, import_ignore.default)().add(patterns) : null,
+          hasNegation: patterns.some((line) => line.trimStart().startsWith("!")),
+          attributes: attributes.length > 0 ? attributes : null
+        };
+      }
+      /**
+       * What the .gitignore / .mnemonikignore layers in `stack` say about
+       * `entryRel` (relative to the scan root). Tested deepest-first: the first
+       * layer that explicitly ignores OR re-includes (via a `!negation`) wins,
+       * matching git's rule that a deeper `.gitignore` overrides a shallower one.
+       * Directories are tested with a trailing slash so `foo/` dir-only rules
+       * match the directory itself. `'unignored'` means a negation matched this
+       * path itself; a re-included parent directory leaves its files `'unmatched'`.
+       */
+      ignoreVerdict(entryRel, isDir, stack) {
+        for (let i = stack.length - 1; i >= 0; i--) {
+          const layer = stack[i];
+          if (!layer?.ig)
+            continue;
+          const { baseRel, ig } = layer;
+          let sub;
+          if (baseRel === "") {
+            sub = entryRel;
+          } else if (entryRel === baseRel || !entryRel.startsWith(baseRel + "/")) {
+            continue;
+          } else {
+            sub = entryRel.slice(baseRel.length + 1);
+          }
+          if (!sub)
+            continue;
+          const res = ig.test(isDir ? sub + "/" : sub);
+          if (res.ignored)
+            return "ignored";
+          if (res.unignored)
+            return "unignored";
+        }
+        return "unmatched";
+      }
+      ignoredByStack(entryRel, isDir, stack) {
+        return this.ignoreVerdict(entryRel, isDir, stack) === "ignored";
+      }
+      static attributeLayers(stack) {
+        return stack.flatMap((layer) => layer.attributes ? [{ baseRel: layer.baseRel, rules: layer.attributes }] : []);
+      }
+      /**
+       * Skip this directory? User-ignored directories are skipped as before. A
+       * directory a soft default excludes (vendor/, generated/, ...) is pruned too -
+       * nothing under it can be indexed - UNLESS a rule above it could re-include
+       * something inside it: a `!pattern` or a `-linguist-*` attribute. Then the
+       * walk descends and judges each file, so the override works. Rule files
+       * INSIDE a pruned directory are never read: a vendored library's own
+       * .gitignore negations are not the project's intent.
+       */
+      skipDirectory(relPath, stack) {
+        const posixRel = relPath.split(sep).join("/");
+        const verdict = this.ignoreVerdict(posixRel, true, stack);
+        if (verdict === "ignored")
+          return true;
+        if (verdict === "unignored")
+          return false;
+        if (!softDefaultForDirectory(posixRel))
+          return false;
+        const canReinclude = stack.some((layer) => layer.hasNegation) || gitattributesCanReinclude(_FileSelector.attributeLayers(stack));
+        return !canReinclude;
+      }
+      /**
+       * The index decision for a file from its path and the rule stack: `null`
+       * when a user ignore rule excludes it, otherwise the classifier's answer
+       * (precedence in indexClassifier.ts). Content rules are the caller's next
+       * step for an included path without an `override`.
+       */
+      classifyEntry(relPath, stack) {
+        const posixRel = relPath.split(sep).join("/");
+        const verdict = this.ignoreVerdict(posixRel, false, stack);
+        if (verdict === "ignored")
+          return null;
+        return classifyForIndex(posixRel, {
+          ignoreFileVerdict: verdict,
+          attributes: _FileSelector.attributeLayers(stack)
+        });
+      }
+      /**
+       * Reconstruct the root->parent ignore-layer stack for a single file, for the
+       * incremental `scanFiles` path (which has a flat file list, not a recursive
+       * walk). Layers are memoized per directory in `cache` across a batch.
+       */
+      async buildIgnoreStackForFile(fileRel, rootPath, cache, walk) {
+        const dirs = [""];
+        let acc = "";
+        for (const seg of fileRel.split("/").slice(0, -1)) {
+          acc = acc === "" ? seg : `${acc}/${seg}`;
+          dirs.push(acc);
+        }
+        const stack = [];
+        for (const dir of dirs) {
+          let layer = cache.get(dir);
+          if (layer === void 0) {
+            layer = await this.loadIgnoreLayer(dir === "" ? rootPath : join2(rootPath, dir), dir, walk, rootPath);
+            cache.set(dir, layer);
+          }
+          if (layer)
+            stack.push(layer);
+        }
+        return stack;
+      }
+      /**
+       * A predicate for walkers outside this class (the daemon's file watcher):
+       * true when the walk would descend into `absDir`, by the same rules
+       * `listFiles` applies - user ignore files and soft-default directories,
+       * with their overrides. Rule files are read once per directory for the life
+       * of the returned predicate; take a fresh one after a rule file changes.
+       * Directories outside `rootPath`, and the root itself, always pass.
+       */
+      directoryFilter(rootPath) {
+        const cache = /* @__PURE__ */ new Map();
+        return async (absDir) => {
+          try {
+            const root = await this.canonicalRoot(rootPath);
+            const rel = relative(root, absDir).split(sep).join("/");
+            if (!rel || rel.startsWith(".."))
+              return true;
+            const stack = await this.buildIgnoreStackForFile(rel, root, cache, { complete: true });
+            return !this.skipDirectory(rel, stack);
+          } catch {
+            return true;
+          }
+        };
+      }
+      /**
+       * True when any directory strictly between `rootPath` and `filePath`
+       * starts a subtree this project does not index (see isProjectBoundary). Paths that don't
+       * resolve under `rootPath` are not judged here (return false) - the
+       * server's path validation handles escapes.
+       */
+      async insideNestedGitBoundary(filePath, rootPath) {
+        const rel = relative(rootPath, filePath);
+        if (!rel || rel.startsWith(".."))
+          return false;
+        const segments = rel.split(sep);
+        let current = rootPath;
+        for (let i = 0; i < segments.length - 1; i++) {
+          const segment = segments[i];
+          if (segment === void 0)
+            continue;
+          current = join2(current, segment);
+          if (await this.isBoundary(current, rootPath))
+            return true;
+        }
+        return false;
+      }
+      rootProjectIds = /* @__PURE__ */ new Map();
+      /**
+       * isProjectBoundary, with the scan root's own project as the enclosing one.
+       * The root's file is read at most once a minute: a walk tests many folders,
+       * and a project relinked since is seen on the next scan.
+       */
+      async isBoundary(dirPath, rootPath) {
+        let cached = this.rootProjectIds.get(rootPath);
+        if (!cached || Date.now() - cached.at > 6e4) {
+          cached = { at: Date.now(), projectId: rootProjectId(rootPath) };
+          this.rootProjectIds.set(rootPath, cached);
+        }
+        return isProjectBoundary(dirPath, await cached.projectId);
+      }
+      canonicalRoots = /* @__PURE__ */ new Map();
+      async canonicalRoot(root) {
+        let canonical = this.canonicalRoots.get(root);
+        if (!canonical) {
+          canonical = await realpath(root);
+          this.canonicalRoots.set(root, canonical);
+        }
+        return canonical;
+      }
+      static containsCanonical(candidate, root, paths = { sep, resolve }, caseInsensitive = process.platform === "win32") {
+        candidate = paths.resolve(candidate);
+        root = paths.resolve(root);
+        if (caseInsensitive) {
+          candidate = candidate.toLowerCase();
+          root = root.toLowerCase();
+        }
+        return candidate === root || candidate.startsWith(root.endsWith(paths.sep) ? root : root + paths.sep);
+      }
+      async confineSymlink(fullPath, canonicalRoot) {
+        let path = resolve(fullPath);
+        if (!_FileSelector.containsCanonical(path, canonicalRoot))
+          return false;
+        for (; ; ) {
+          if (this.skipSymlink(await lstat2(path)))
+            throw new Error("symlink_skipped");
+          if (_FileSelector.containsCanonical(canonicalRoot, path))
+            break;
+          path = dirname(path);
+        }
+        return _FileSelector.containsCanonical(await realpath(fullPath), canonicalRoot);
+      }
+      async readConfined(fullPath, canonicalRoot, enumerated) {
+        const expected = enumerated ?? await lstat2(fullPath);
+        if (this.skipSymlink(expected))
+          throw new Error("symlink_skipped");
+        if (!expected.isFile())
+          throw new Error("scanner_not_regular");
+        if (!await this.confineSymlink(fullPath, canonicalRoot))
+          throw new Error("scanner_containment");
+        const canonical = await realpath(fullPath);
+        if (!_FileSelector.containsCanonical(canonical, canonicalRoot) || await this.isProtectedRead(canonical))
+          throw new Error("scanner_containment");
+        const flags = constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW ?? 0);
+        const handle = await open(fullPath, flags).catch((error) => {
+          if (error.code === "ELOOP") {
+            this.skipReasons.symlink_skipped++;
+            throw new Error("symlink_skipped");
+          }
+          throw error;
+        });
+        try {
+          const actual = await handle.stat();
+          if (!actual.isFile())
+            throw new Error("scanner_not_regular");
+          if (actual.dev !== expected.dev || actual.ino !== expected.ino)
+            throw new Error("scanner_identity_changed");
+          if (process.platform === "win32" && this.skipSymlink(await lstat2(fullPath)))
+            throw new Error("symlink_skipped");
+          if (process.platform === "linux" && await realpath(`/proc/self/fd/${handle.fd}`) !== canonical)
+            throw new Error("scanner_containment");
+          return await handle.readFile("utf-8");
+        } finally {
+          await handle.close();
+        }
+      }
+      /**
+       * Enumerate scan-eligible relative file paths under `rootPath` without
+       * reading or chunking content. Same walk + ignorePatterns + extension
+       * filter as `scanDirectory`, but bounded to O(file count) directory ops
+       * - cheap enough to call on every periodic reconcile tick.
+       *
+       * Returns relative paths normalized against `rootPath`, matching the
+       * shape the server stores in `memories.metadata->>'filePath'`. Use this
+       * for the scanner reconciliation channel (`POST /api/v1/scan/reconcile`).
+       *
+       * Defensive: skips any path whose `relative()` result contains a `..`
+       * traversal segment (can happen when a symlink resolves under root but
+       * the readdir entry path doesn't normalize cleanly). The server's
+       * `safeScanPath` rejects such paths; filtering here keeps a single
+       * malformed entry from failing the entire reconcile push.
+       */
+      async listFiles(rootPath) {
+        const { paths } = await this.listFilesWithStatus(rootPath);
+        return paths;
+      }
+      /**
+       * Completeness-aware variant of `listFiles`. `complete === false` means
+       * an fs error truncated part of the walk - the returned paths may be
+       * missing files that still exist on disk. The daemon's reconcile channel
+       * MUST NOT derive removedFiles from an incomplete inventory (a truncated
+       * walk otherwise reads as mass deletion and deprecates live memories).
+       */
+      async listFilesWithStatus(rootPath) {
+        rootPath = await this.canonicalRoot(rootPath);
+        const paths = [];
+        const overridden = /* @__PURE__ */ new Set();
+        const stats = /* @__PURE__ */ new Map();
+        const walk = { complete: true, rules: /* @__PURE__ */ new Map() };
+        await this.traversePaths(rootPath, rootPath, paths, 0, walk, [], overridden, stats);
+        if (walk.complete && walk.rules)
+          this.ruleFilesByRoot.set(rootPath, walk.rules);
+        return {
+          paths: paths.filter((p) => !/(^|[/\\])\.\.([/\\]|$)/.test(p)),
+          complete: walk.complete,
+          overridden,
+          unreadable: walk.unreadable ?? 0,
+          unreadableSamples: walk.unreadableSamples ?? [],
+          stats
+        };
+      }
+      /**
+       * The rule files the last complete `listFilesWithStatus` walk of `rootPath`
+       * applied, by directory ('' = root). Null before the first complete walk.
+       * The daemon uploads these lines so the server judges paths as it did.
+       */
+      async indexRuleFiles(rootPath) {
+        return this.ruleFilesByRoot.get(await this.canonicalRoot(rootPath)) ?? null;
+      }
+      ruleFilesByRoot = /* @__PURE__ */ new Map();
+      async traversePaths(currentPath, rootPath, out, depth, walk, stack = [], overridden, statsOut) {
+        if (this.isProtected(currentPath))
+          return;
+        let entries;
+        try {
+          if (!await this.confineSymlink(currentPath, rootPath))
+            throw new Error("scanner_containment");
+          if (depth === 0 && !await enterDirectory(walk, currentPath))
+            return;
+          entries = await fileOp(() => readdir(currentPath), `readdir: ${currentPath}`);
+        } catch (error) {
+          markUnreadable(walk, currentPath, error);
+          debug("Error traversing directory (listFiles)", { path: currentPath, error });
+          return;
+        }
+        const dirRel = currentPath === rootPath ? "" : relative(rootPath, currentPath).split(sep).join("/");
+        const localLayer = await this.loadIgnoreLayer(currentPath, dirRel, walk, rootPath);
+        const localStack = localLayer ? [...stack, localLayer] : stack;
+        for (const entry of entries) {
+          const fullPath = join2(currentPath, entry);
+          const relativePath = relative(rootPath, fullPath);
+          if (this.isProtected(fullPath))
+            continue;
+          if (this.shouldIgnore(relativePath))
+            continue;
+          try {
+            const lstats = await fileOp(() => lstat2(fullPath), `lstat: ${fullPath}`);
+            if (this.skipSymlink(lstats))
+              continue;
+            const stats = lstats;
+            if (stats.isDirectory()) {
+              if (this.skipDirectory(relativePath, localStack))
+                continue;
+              if (await this.isBoundary(fullPath, rootPath))
+                continue;
+              const leave = await enterDirectory(walk, fullPath);
+              if (!leave)
+                continue;
+              try {
+                await this.traversePaths(fullPath, rootPath, out, depth + 1, walk, localStack, overridden, statsOut);
+              } finally {
+                leave();
+              }
+            } else if (stats.isFile()) {
+              if (!this.isChunkable(fullPath, relativePath))
+                continue;
+              const decision = this.classifyEntry(relativePath, localStack);
+              if (!decision?.include)
+                continue;
+              out.push(relativePath);
+              statsOut?.set(relativePath, statTuple(stats));
+              if (decision.override)
+                overridden?.add(relativePath);
+            }
+          } catch (error) {
+            markUnreadable(walk, fullPath, error);
+            debug("Error traversing directory (listFiles)", { path: fullPath, error });
+          }
+        }
+      }
+      /**
+       * Check if path should be ignored
+       * Fixed glob-to-regex conversion and substring matching.
+       * - Escape regex special chars before replacing * with .*
+       * - Replace ALL * occurrences (not just the first)
+       * - For non-glob patterns, match on path segments to avoid false positives
+       *   (e.g., '.env' should not match '.environment.ts')
+       */
+      shouldIgnore(path) {
+        if (isSecretFile(path))
+          return true;
+        const segments = path.split("/");
+        return this.selection.ignorePatterns.some((pattern) => {
+          if (pattern.includes("*")) {
+            const anchored = pattern.startsWith("/");
+            const body = anchored ? pattern.slice(1) : pattern;
+            const escaped = body.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+            const source = escaped.replace(/\*/g, ".*");
+            const regex = new RegExp(anchored ? `(^|/)${source}` : source);
+            return regex.test(path);
+          }
+          return segments.some((segment) => segment === pattern) || path.endsWith("/" + pattern);
+        });
+      }
+    };
+  }
+});
+
+// packages/cli/src/scanner/estimate.ts
+import { lstat as lstat3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+var COUNT_TIME_BOUND_MS = 3e4;
+async function defaultLister() {
+  const { FileSelector: FileSelector2 } = await Promise.resolve().then(() => (init_fileSelection(), fileSelection_exports));
+  const selector = new FileSelector2();
+  return (root) => selector.listFilesWithStatus(root);
+}
+async function countIndexableFiles(roots, options = {}) {
+  const now = options.now ?? Date.now;
+  const deadline = now() + (options.timeBoundMs ?? COUNT_TIME_BOUND_MS);
+  const list = options.list ?? await defaultLister();
+  let files = 0;
+  let bytes = 0;
+  for (const root of roots) {
+    const remaining = deadline - now();
+    if (remaining <= 0) return { files, bytes, partial: true };
+    const listed = await Promise.race([
+      list(root),
+      new Promise((resolve2) => setTimeout(() => resolve2(null), remaining).unref())
+    ]);
+    if (!listed) return { files, bytes, partial: true };
+    for (let i = 0; i < listed.paths.length; i += 64) {
+      if (now() > deadline) return { files, bytes, partial: true };
+      const sizes = await Promise.all(
+        listed.paths.slice(i, i + 64).map(
+          (path) => lstat3(join3(root, path)).then(
+            (stat) => stat.size,
+            () => null
+          )
+        )
+      );
+      for (const size of sizes) {
+        if (size === null) continue;
+        files++;
+        bytes += size;
+      }
+    }
+  }
+  return { files, bytes, partial: false };
+}
+var number = (value) => value.toLocaleString("en-US");
+function formatBytes(bytes) {
+  if (bytes < 1024 * 1024) return `${Math.max(1, Math.round(bytes / 1024))} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${number(Math.round(bytes / (1024 * 1024)))} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+}
+function unit(seconds) {
+  if (seconds < 90 * 60) return { value: Math.max(1, Math.round(seconds / 60)), name: "minute" };
+  if (seconds < 48 * 3600) return { value: Math.round(seconds / 3600), name: "hour" };
+  return { value: Math.round(seconds / 86400), name: "day" };
+}
+function formatDurationRange(lowSeconds, highSeconds) {
+  if (highSeconds < 60) return "under a minute";
+  const low = unit(lowSeconds);
+  const high = unit(highSeconds);
+  const plural = (n, name) => `${n} ${name}${n === 1 ? "" : "s"}`;
+  if (low.name !== high.name)
+    return `about ${plural(low.value, low.name)} to ${plural(high.value, high.name)}`;
+  if (low.value === high.value) return `about ${plural(high.value, high.name)}`;
+  return `about ${low.value} to ${plural(high.value, high.name)}`;
+}
+function onboardingEstimateLines(count, estimate) {
+  if (count.files === 0) return [];
+  const files = `${count.partial ? "at least " : ""}${number(count.files)} file${count.files === 1 ? "" : "s"}`;
+  const lines = [`Mnemonik will index ${files} (${formatBytes(count.bytes)}).`];
+  if (estimate) {
+    const busy = estimate.accountsAhead > 0 ? " at the current load" : "";
+    lines.push(
+      `Indexing will take ${formatDurationRange(estimate.lowSeconds, estimate.highSeconds)}${busy}. You can keep working while it runs; files become searchable as they are indexed.`
+    );
+  }
+  return lines;
+}
+export {
+  COUNT_TIME_BOUND_MS,
+  countIndexableFiles,
+  formatBytes,
+  formatDurationRange,
+  onboardingEstimateLines
+};